Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-3402 is a Stored Cross-Site Scripting (XSS) vulnerability in the PHPGurukul Student Record Management System version 1.0. It exists in the /edit-course.php endpoint, specifically in the "Course Short Name" field. The system does not properly validate or encode user input before storing it in the database and rendering it in the browser.'}, {'type': 'paragraph', 'content': 'An authenticated administrator can exploit this vulnerability by injecting malicious JavaScript code into the Course Short Name field via the add course functionality. This malicious code is stored persistently and executes whenever the course information is viewed or edited through the manage courses interface.'}] [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': "This vulnerability allows execution of arbitrary JavaScript code in the context of an authenticated administrator's session."}, {'type': 'list_item', 'content': 'Potential session hijacking through theft of cookies.'}, {'type': 'list_item', 'content': 'Unauthorized actions performed on behalf of the administrator.'}, {'type': 'list_item', 'content': 'Persistent compromise affecting all users who view or edit the modified course record.'}] [1, 2, 3]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking for the presence of malicious JavaScript code injected into the "Course Short Name" field in the /edit-course.php endpoint of the PHPGurukul Student Record Management System version 1.0.'}, {'type': 'paragraph', 'content': 'One method to identify vulnerable targets is using Google dorking with queries such as "inurl:edit-course.php" to find instances of the affected endpoint.'}, {'type': 'paragraph', 'content': 'To confirm exploitation, an authenticated administrator can attempt to inject a test payload like `"><script>alert(document.cookie)</script>` into the Course Short Name field via the add course functionality and then observe if the script executes when viewing or editing the course.'}, {'type': 'paragraph', 'content': 'No specific network commands are provided, but manual testing through the web interface or automated scanning tools targeting the /edit-course.php endpoint and the Course Short Name parameter can be used.'}] [2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include implementing strict server-side input validation and sanitization to prevent malicious scripts from being stored.'}, {'type': 'paragraph', 'content': "Use context-aware output encoding functions such as PHP's htmlspecialchars() when rendering user input to the browser."}, {'type': 'paragraph', 'content': 'Deploy a strong Content Security Policy (CSP) to restrict the execution of unauthorized scripts.'}, {'type': 'paragraph', 'content': 'Enable HTTPOnly and Secure flags on session cookies to reduce the risk of session hijacking.'}, {'type': 'paragraph', 'content': 'Conduct secure code reviews and apply centralized input filtering to ensure consistent security practices.'}, {'type': 'paragraph', 'content': 'Perform security testing prior to deployment to detect and fix such vulnerabilities.'}] [2]

Useful 0 Not Useful 0